Tracking Malware Campaigns With Reused Material

Summary

This campaign reuses a JPEG “carrier” image that hides a malicious payload between BaseStart- and -BaseEnd tags. Initial access comes via Microsoft Equation Editor exploitation (CVE-2017-11882) in a crafted attachment, which downloads an HTA. The HTA runs PowerShell to retrieve a .NET binary stage. Reuse of the same image across many samples suggests the operator relies on repeatable components.

Investigation

The researcher observed TELERADIO_IB_OBYEKTLRIN_BURAXILIS_FORMASI.xIs containing the Equation Editor exploit. The chain fetches an HTA from a malicious IP, which executes PowerShell to download a second payload hosted on another IP. The final stage is a .NET binary embedded in the JPEG carrier and recovered via the BaseStart/-BaseEnd delimiters. Similar carrier images were found in dozens of VirusTotal submissions.

Mitigation

Patch CVE-2017-11882 and keep Office updated. Block or restrict HTA execution, enforce PowerShell script signing, and use URL/IP filtering to deny access to the hosting infrastructure.

Response

Detect and quarantine the attachment and HTA stage, and alert on PowerShell download activity to the identified IPs. Isolate affected hosts and perform memory forensics to locate and remove the in-memory .NET payload.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary has exploited a client‑side vulnerability that serves a malicious HTA file. The HTA launches PowerShell with a command line that embeds a malicious payload (e.g., Invoke‑Expression to launch calc.exe) encoded in Base64. The payload is wrapped between the strings BaseStart- and -BaseEnd so that the attacker can reliably extract it on‑the‑fly. The command executed on the compromised host is:

  powershell.exe -NoProfile -Command "$b='BaseStart-$( [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Start-Process calc.exe')) )-BaseEnd'; $payload=$b -replace '.*BaseStart-','' -replace '-BaseEnd.*',''; IEX ([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($payload)))"

  This command line satisfies both selection_base_start and selection_base_end conditions, causing the rule to fire.

• Regression Test Script: The following self‑contained PowerShell script reproduces the malicious behavior and can be run on any Windows host with the telemetry enabled above.

  # Regression Test Script – triggers the detection rule
  # 1. Build Base64‑encoded payload (launch calc.exe)
  $payload = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Start-Process calc.exe'))
  
  # 2. Assemble the full command line with delimiters
  $cmd = "BaseStart-$payload-BaseEnd"
  
  # 3. Execute PowerShell with the crafted command line
  $fullCommand = "powershell.exe -NoProfile -Command `"& {`$b='$cmd'; `$payload=`$b -replace '.*BaseStart-','' -replace '-BaseEnd.*',''; IEX ([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(`$payload)))`""
  
  # 4. Run the command (this will launch calc.exe)
  Invoke-Expression $fullCommand

• Cleanup Commands: Remove any artefacts and terminate the spawned process if needed.

  # Cleanup – close Calculator if still running and clear command history
  Get-Process calc -ErrorAction SilentlyContinue | Stop-Process -Force
  # Optionally clear PowerShell history (only for the current session)
  Remove-Item (Get-PSReadlineOption).HistorySavePath -ErrorAction SilentlyContinue